> ## Documentation Index
> Fetch the complete documentation index at: https://docs-vnext.kiflo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Settings — API Tokens, SSO, and MFA in Kiflo

> Generate and revoke API Access Tokens, configure Single Sign-On (SSO) for your team, and enable Multi-Factor Authentication to protect your Kiflo account.

Kiflo gives you several tools to keep your account and your data secure. This page covers API Access Tokens for integrations, Single Sign-On (SSO) for centralized identity management, and Multi-Factor Authentication (MFA) for an additional layer of login protection.

## API Access Tokens

API Access Tokens authenticate external applications — such as WordPress, Zapier, or your own custom tools — to communicate with Kiflo. You can create multiple tokens and assign each one a descriptive name so you always know which application uses which token.

### Generate an API Access Token

<Steps>
  <Step title="Open Account Settings">
    Click your account menu in the top-right corner and select **Account**.
  </Step>

  <Step title="Go to Integration settings">
    In the left-hand menu, click **Integration**, then scroll down to the **API Access Token** section.
  </Step>

  <Step title="Add a new token">
    Click the **Add** button.
  </Step>

  <Step title="Name your token">
    Enter a descriptive name that identifies the application you are connecting (e.g. `WordPress`, `Zapier`, or `Custom CRM Integration`).
  </Step>

  <Step title="Confirm and copy">
    Click **Add** again to generate the token. Click the **Paste** button (copy to clipboard) to capture the token immediately.
  </Step>
</Steps>

<Warning>
  Kiflo does not store the token value after generation. If you navigate away without copying it, the token is gone and you will need to generate a new one.
</Warning>

### Revoke an API Access Token

Revoke a token when you decommission an integration, suspect unauthorized access, or rotate credentials as part of your security policy. Revoking a token immediately prevents the associated application from connecting to your Kiflo account.

<Steps>
  <Step title="Open Account Settings">
    Click your account menu in the top-right corner and select **Account**.
  </Step>

  <Step title="Go to Integration settings">
    In the left-hand menu, click **Integration** and scroll to the **API Access Token** section.
  </Step>

  <Step title="Select the token">
    Find the token you want to revoke in the list.
  </Step>

  <Step title="Revoke">
    Click **Revoke**, then click **Yes, I'm sure** in the confirmation dialog.
  </Step>
</Steps>

The token is immediately invalidated. Any application using that token will receive an authentication error on its next request.

***

## Single Sign-On (SSO)

SSO lets your team members sign in to Kiflo using your existing identity provider (IdP), such as Okta, Azure AD, or Google Workspace. This centralizes access management — when you offboard an employee in your IdP, their Kiflo access is revoked automatically.

### Set up SSO

<Steps>
  <Step title="Open Security settings">
    Go to **Account Settings > Security**.
  </Step>

  <Step title="Configure your identity provider">
    Follow the SSO setup guide for your IdP. You will need to provide Kiflo's SSO metadata (available on the Security settings page) to your IdP, and provide your IdP's metadata back to Kiflo.
  </Step>

  <Step title="Test the connection">
    Use the test flow in the Security settings to verify that authentication works correctly before enforcing SSO for all users.
  </Step>

  <Step title="Enforce SSO (optional)">
    Once verified, you can require all team members to sign in via SSO only.
  </Step>
</Steps>

### Sign in with SSO

Once SSO is configured, team members can sign in to Kiflo using their company credentials:

1. Go to the Kiflo login page.
2. Click **Sign in with SSO**.
3. Enter your company email address.
4. You will be redirected to your identity provider to authenticate.
5. After successful authentication, you are returned to Kiflo and signed in.

<Note>
  If your administrator has enforced SSO, the standard email/password login option will not be available.
</Note>

***

## Multi-Factor Authentication (MFA)

MFA adds a second verification step to the Kiflo login process, significantly reducing the risk of unauthorized access even if a password is compromised.

### Enable MFA for your account

<Steps>
  <Step title="Open Security settings">
    Go to **Account Settings > Security**.
  </Step>

  <Step title="Enable MFA">
    Toggle on **Multi-Factor Authentication**.
  </Step>

  <Step title="Set up your authenticator app">
    Scan the QR code displayed in Kiflo with an authenticator app (such as Google Authenticator, Authy, or Microsoft Authenticator).
  </Step>

  <Step title="Verify">
    Enter the one-time code from your authenticator app to confirm setup. MFA is now active on your account.
  </Step>
</Steps>

After enabling MFA, you will be prompted for a one-time code from your authenticator app each time you sign in to Kiflo.

<Tip>
  Store your MFA recovery codes in a secure location. If you lose access to your authenticator app, you will need a recovery code to regain access to your account.
</Tip>